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SUMMARY 


The MSA has completed two phases of a general piloted launch 
vehicle study. The first phase studied the feasibility of using a pilot 
to guide and control a vehicle from earth lift-off through insertion 
into earth orbit. Two different study methods were used. One method 
was primarily a paper and pencil study, based on servo-analysis theory, 
wherein a mathematical model was used to describe pilot behavior. The 
other approach used simulators extensively. The first part of this 
paper discusses the relative adequacy of these methods. It was con- 
cluded that much can be learned by analytical procedures alone, but 
that assuming a linear pilot model has its pitfalls. 

In the second phase of the study, a ground-based flight simulator 
was used to measure the contribution to mission reliability of allowing 
the crew to participate actively in guiding and controlling the vehicle 
if certain primary flight control systems fail. The second part of 
this paper discusses the methods used in this reliability analysis. It 
was concluded that this procedure can systematically determine mission 
success for complex manual control problems. 
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and Dallas G. Denery 
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1. INTRODUCTION 


The NASA is conducting a general research program concerned with 
pilot control of large, flexible launch vehicles. The launch vehicles 
being considered are of the Saturn V class, which will be used in the 
forthcoming manned lunar mission. 

This program was motivated by the possibility that the guidance and 
control system of such a vehicle might be simplified, and the reliability 
and performance improved if the capabilities of the human pilot were 
utilized. The research program, to date, has encompassed two major 
phases. In the initial phase, the feasibility was studied of using a 
pilot to guide and control from earth lift-off through insertion into an 
earth orbit. In the second phase, a more sophisticated and refined 
investigation was conducted wherein a piloted control system was defined 
as a backup for the primary automatic flight control system. During 
this phase, the extent to which mission reliability would be increased 
by allowing the crew to participate actively in guiding and controlling 
the vehicle in the event of an emergency was measured. The purpose of 
this paper is to discuss some of the methods used to analyze the pilot- 
vehicle control system. 

A perfectly logical question at this point is "Why discuss well- 
known techniques for analyzing pilot-vehicle control systems?" First, 
the project is somewhat unique in that, essentially, two different 
methods were used to study the feasibility of using a pilot to guide 
and control the launch vehicle . One method was mainly a paper and 
pencil study based on servo-analysis theory wherein the pilot-vehicle 
control system is treated as a closed loop (l— 3 ) * The other approach 
used simulators extensively. In the latter case, the so-called experi- 
mental approach was emphasized. Conducting these studies independently 
and in parallel affords an excellent opportunity to examine the rela- 
tive merits of these two methods. Therefore, in the first part of this 
paper, the adequacy of these methods will be discussed. The pilot 
control systems derived by servo-analysis methods will be compared with 
systems derived by the more conventional simulator approach. The study 
of pilot control systems using the servo-analysis approach will be 
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termed "analytical," and the flight simulator approach -will he termed 
"experimental." The experimental method was used by NASA (4,5) , while 
the analytical method was used by Systems Technology Inc. under contract 
to NASA (6,7) • 

The second section of this paper will briefly discuss the simulator 
investigation of the probability of mission success. It is believed that 
this reliability analysis using piloted simulators is unique. The 
method, as well as some of the general conclusions regarding the pilot’s 
contribution to mission reliability, should be of general interest to 
engineers concerned with the interface of a piloted backup system with a 
primary automatic flight-control system since it is not limited to a 
specific vehicle. 


2. SIMIIARITIES BETWEEN IAUNCH VEHICLES AND IARGE WINGED VEHICLES 


The methods of studying large flexible boosters should be of value 
in analyses of pilot control systems for airplane-type transports 
because boosters and large airplanes (supersonic, hypersonic, large sub- 
sonic, etc.) have certain common characteristics. Both have fairly 
complex control systems, incorporating rate gyros, inertial platforms, 
signal processing filters, and control- surface power actuators. Both 
are subject to torque biases when an engine fails. Both tend to be 
highly flexible with structural mode frequencies approaching control 
system frequencies. A gross comparison of the approximate "frequency 
spectrum" • for the various degrees of freedom for the two types of 
vehicles is shown in Fig. 1. It might be noted that external distur- 
bances (wind shears) tend to excite and contribute to the body bending 
of both classes of vehicles and are a major factor in the vehicle con- 
trol system design. Finally, in both cases the pilot is located far in 
front of the vehicle center of gravity; consequently, the attendant 
cues (i.e., accelerations, etc.) that could influence pilot control are 
also similar . 

From a task standpoint, we can argue that there is a reasonable 
analogy between the manned boost into orbit and the landing of a large 
aircraft in zero-zero weather conditions; both are terminal control prob- 
lems; both are performed on instruments; both involve similar time 
scales; both primarily involve control of the flight path as the outer 
loop; and both involve such complex kinematics and guidance programs 
that successful completion by a completely unaided human pilot is mar- 
ginal at best. Because of these similarities, some of the techniques 
used in the subject studies may be applicable to certain winged vehicles. 


3 . ANALYTICAL AND EXPERIMENTAL METHODS 


Figure 2 provides some general information which can be used to 
determine a method of analysis for a piloted vehicle control system. 
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The two charts in this figure describe various degrees of system 
analysis complexity. The upper chart is titled “analytical” and the 
lower, "experimental." The "experimental" chart was suggested by Cooper 
and Belsley (8,9)? and is based on an examination of various simulator 
investigations. They concluded that ground-based flight simulators can 
be classed as rudimentary, basic, or advanced, depending upon their 
sophistication. This table is to be used as follows: if the applica- 

tion required of the results is known, as well as the type of results 
desired (qualitative and/or quantitative), the table indicates the type 
of simulator (rudimentary, basic, or advanced) and task that must be 
considered to provide a proper evaluation. The more precise and realis- 
tic (in a flight sense) the information that is required, the more com- 
plete must be the simulation. In the unabridged version of this table 
(9), the rudimentary, basic, and advanced simulators are defined in 
terms of the environment which might be impressed upon the pilot (visual, 
aural, and kinesthetic feedback), the sophistication in the equations of 
motion, extravehicular disturbances, etc. 

A somewhat analogous table can be derived for the analytical 
approach (10) . At least two levels of complexity exist and have been 
arbitrarily labeled "rudimentary" and "basic." The rudimentary analysis 
is composed essentially of an open- loop analysis wherein certain vehicle 
characteristics are computed and compared with preanalyzed and cataloged 
information on pilot ratings given as functions of vehicle dynamic param- 
eters. The basic analysis is synonymous with closed-loop system analysis 
techniques using adaptive pilot models. As in the experimental approach, 
the type and application of the results determine the level of analysis 
required (Fig. 2). The "basic" analysis and "basic" simulator seem to 
have approximately the same area of application. The only essential dif- 
ference, as shown by this table, is that only part task (i.e., essentially 
continuous tracking) can be considered when the basic analytical method 
is used. A basic simulator is not so restricted since sequential and 
decision-making tasks are particularly easy to simulate . 

The methods discussed in this paper are shown on Fig. 2. The 
feasibility studies are classed as basic experimental and basic analytical 
studies. The reliability analysis studies would have to be classed as 
advanced experimental. It should be made clear at this point that the 
analytical and experimental approaches are not competitive methods for 
the analysis of pilot vehicle control systems. If flight simulators are 
available, the two techniques should be combined for maximum efficiency. 
However, for the feasibility studies discussed in this paper, no data on 
the results of the simulation program were made available to the contrac- 
tor conducting the analytical study until the end of the program. This 
severe constraint was deliberately imposed to test the paper and pencil 
methods (i.e., obtain a calibration). Such a calibration was believed 
to be useful if flight simulators were not readily available . 

Figure 2 suggests then that the design and performance of a piloted 
control system can be predicted fairly well without resorting to flight 
simulators for more quantitative information. In fact, it has been 
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suggested that purely analytical processes might he used until it becomes 
necessary to solve operating problems , define minimum acceptable handling 
qualities (l.e • , failure mode analysis), or define certification problems. 
Substantial evidence does support this possibility for conventional 
piloted aircraft ( 10 - 13 ) , but more evidence is necessary before one could 
state this conclusively. In particular, evidence is lacking for the rela- 
tively unexplored problem presented by the flexible launch vehicle , which 
represents a more complex set of dynamics as well as a type of control 
problem for which there is little previous experience . As illustrated in 
Fig. 2, the results of these investigations will be presented in such a 
way as to give the reader an easy insight into the usefulness of the 
"analytic" technique for a relatively unexplored pilot control system 
problem without simulation support . 


4 . TECHNICAL CONSTRAINTS 


To interpret the results properly, it is essential to understand 
the basic technical constraints placed on the experimental and analytical 
studies (Fig. 3 .)* 

In the experimental program, the rigid body equations of motions 
simulated were a perturbation set with respect to a reference frame mov- 
ing along a given nominal trajectory that described the vehicle motion 
in five degrees of freedom (i -e . , three rotational and two translational 
degrees of freedom). The equations of motion were linearized, and the 
coefficients were time varying. The first- and second -mode body -bending 
equations were included in the simulation. The nominal frequency for the 
first bending mode was 1 Hz, and for the second, f=t 2 Hz. Sloshing mass 
accelerations were computed for the two main propellant tanks in the 
first stage . The attitude and rate-gyro locations were assumed to be 
fixed. However, some freedom was allowed in the positioning of the accel- 
erometer used to drive the pilot’s display. The wind disturbance was 
approximated by ramp input building from 0 to 75 m/sec at a rate of about 
10 m/sec 2 . The direction of the wind was randomly rotated between each 
piloted simulation run for the data discussed in the first section of the 
paper. The simulator investigation utilized, for the most part, a fixed 
cockpit. However, a limited number of piloted launches were simulated 
with a five-degree-of -freedom centrifuge so that the launch vehicle 
acceleration could be impressed on the simulator pilot. The changes or 
sensitivity of system performance to variations in certain vehicle param- 
eters were documented during the simulator runs. 

The analytic method was applied only to a fixed (frozen) flight con- 
dition, and the maximum dynamic -pres sure portion of the flight profile 
was the key design point. However, the piloted systems evolved were also 
checked at the lift-off and the first-stage burnout. Fuel sloshing 
dynamics were not included in the analytic study since it appeared from 
simulation studies that they did not significantly influence the control- 
system design; also, their deletion simplified the equations. The 
remaining technical constraints. Fig. 3 , were also applied to the 
analytic study. 
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5* RESULTS and discussion 


5*1 Pilot Vehicle Systems 

During these investigations, considerable effort was made to define 
several competing pilot control systems. These systems were, in 
essence, "candidate systems" which might warrant a more thorough study. 
Three that evolved can he distinguished, approximately, on the basis of 
pilot participation. A brief review of these general forms of pilot- 
vehicle control systems seems appropriate, if for no other reason than 
to understand the systems which came under serious consideration and 
were later defined and analyzed in some detail (Fig . 4). However, all 
of the systems shown in this figure will not be discussed in detail in 
this paper . 

The fully manual system was considered first. In this case, the 
pilot observes certain displays that indicate the vehicle's state; he 
may establish certain feedback paths internal to himself; then he 
directly controls the servos that swivel the engines in an attempt to 
control the vehicle's flight path and stabilize certain modes of motion 
(e.g., rigid body, body bending, etc.). 

The second system in this figure Is termed "series pilot plus aug- 
mented vehicle." The pilot is a principal element in the control system; 
however, an inner feedback loop is established around the vehicle. This 
loop augments the vehicle's stability and improves its handling qualities 
and the overall pilot-vehicle control system performance . 

In the third system of Fig. 4, the pilot is shown operating in a 
parallel or trimmer mode of control wherein he can change the vehicle ' s 
flight path by putting in a bias or trimming command to an automatic 
flight-control system. 

Hence , for this specific control problem, whether attacked analyt- 
ically or experimentally, only the three general forms of vehicle - 
control system need further consideration and investigation. 

Incidentally, one might question whether these general system forms were 
specifically products of the analytic and/or experimental approach or 
whether they resulted primarily from the respective investigator's 
experience and general knowledge of pilot-vehicle control systems . This 
question probably cannot be resolved because the general forms of these 
systems are quite obvious and have well established precedents in current 
piloted airplane control systems. 


5.2 Pilot Models 

Theoretically, if human behavior were exactly predictable in a con- 
trol task, the same information could be obtained by both flight simula- 
tion and analytical techniques. Obviously, at this time, human behavior 
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is not exactly predictable. (This fact gives flight simulation its one 
primary advantage over analytical techniques for studying piloted control.) 
Nevertheless , before the analytic study of a closed-loop system can pro- 
ceed in earnest , suitable approximate mathematical representations must be 
derived for each element comprising the closed-loop system, including the 
pilot. In recent years, a great deal of research and study has been 
directed toward describing human behavior in a control task. Because of 
mathematical complexities, this research has largely been confined to 
deriving a "quasi-linear mathematical model" for a pilot while controlling 
a system described by linearized, constant coefficient equations. Such a 
pilot model consists of a linear describing function, Yp , as well as a 
remnant component. It is sufficient to say that the key to the success 
or failure of the analytic approach depends upon the validity of approx- 
imating the pilot-vehicle control system by a set of linearized, constant 
coefficient equations plus a stochastic remnant, and upon the adequacy of 
the derived pilot model. The dynamic characteristics of the human pilot 
in terms compatible with flight-control engineering practice are sum- 
marized in (l4) . Despite the rather severe limitations on the region and 
applicability of these data, they have been used very successfully in 
studying and analyzing the more or less conventional aircraft pilot 
control problem. The validity, however, of extrapolating these pilot 
models and associated adaptation rules to controlled elements having 
higher order dynamics, such as large flexible boosters or large airplane 
transports, could be questioned. In the following section, a cursory 
evaluation is made of the validity of extrapolating the pilot model data 
of (l4) . The pilot models derived from the data and procedures of (l4) 
are applied to the booster control problem in the analytic study and will 
be compared with pilot models derived from measurements made with a 
pilot flying the launch vehicle simulation. 

As previously implied, the pilot models are limited to the case of 
a time invariant controlled element . For the data presented in this 
section, the controlled element was the unaugmented launch-vehicle 
dynamics at a discrete time of flight, 77 sec after launch. This is 
essentially the maximum dynamic pressure flight condition and the point 
at which the vehicle is most difficult to control. Under these condi- 
tions (i.e . , unaugmented vehicle and maximum dynamic pressure condition), 
the prediction of a pilot model is most challenging and seems to repre- 
sent an "acid" test of the techniques involved. 

In discussing pilot-model data, it is well to begin by defining the 
dynamics of the controlled element. The frequency response of the 
unaugmented vehicle and its control system as used in the simulator study 
is compared in Fig. 5 with the controlled element dynamics for the ana- 
lytic investigation. _ A slight difference can be seen at both the low and 
high frequency portions of the spectrum. That at low frequency is due to 
the assumption that velocity was constant while the equations of motion 
were analyzed. The high frequency discrepancies are due to slight dif- 
ferences in the engine dynamics and bending frequencies used. The large 
difference in gain at the first bending mode can be attributed partly to 
a lower first bending mode natural frequency and partly to a neglect of 
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the second bending mode in the experimental analysis as compared to the 
analytic study. The main characteristics of the systems are the same, 
and the effects of the noted discrepancies on the subsequent pilot 
describing function data should be small. 


5 . 2.1 Analytic pilot describing function 


Solely analytical techniques and the controlled element dynamics of 
Fig. 5 were used to form a pilot describing function for the linear 
component of the pilot model by the adaptation rules established from 
existing data. This pilot describing function is as follows: 


Y = 
P 


p.5(2jw + l)e 


■0.2 jw 


JW 

10 


, 2 ( 1 ) (jw) 
10 


The first numerator term (0.5) is the pilot gain in radians of engine 
angle command per radian of attitude error. The term (2ju> + l) is the 
lead equalization supplied by the pilot to stabilize the vehicle and 
control the pilot-vehicle system adequately. The exponent -0.2 jw 
represents the delay in the pilot's reaction time and the denominator 
term, (jw/10) 2 + 2(l) ( jw/10) + 1, represents his neuromuscular lag. 

5 . 2.2 Measured pilot describing function 

As noted previously, pilot describing functions were also measured 
experimentally with an actual pilot flying the unaugmented vehicle in a 
fixed-cockpit flight simulator . For these tests, the pilot was given a 
random appearing attitude tracking task in the pitch plane. The fre- 
quency and amplitude of the input were comparable to the input spectrum 
of the jetstream wind disturbance . The random appearing input signal 
was characterized by a 2° RMS value with a bandwidth of O.I83 rad/ sec. 

The error signal was displayed to the pilot by a horizontal bar on an 
oscilloscope. The power spectrum of the input and modified Fourier 
transform of the idealized wind spike are shown in Fig. 6. The random 
input signal was composed of eight nonharmonic sine waves, four primary 
and four secondary. This particular forcing function was used so that 
a random appearing signal would be obtained in the frequency range of 
booster task demands, less than 0.2 rad/sec, and still provide energy at 
higher frequencies without affecting the pilot's low frequency perfor- 
mance . This type of "augmented rectangular input spectrum" has been 
used successfully in the past and is described more fully in (l 4 ) . The 
power spectral characteristics of the wind spike were obtained by defin- 
ing a "pseudo-autocorrelation function" as (l/p)lim T -*• 00 f (t)f(t+r)dr 

(15) where p is the interval of wind disturbance. Taking the Fourier 
transform of this autocorrelation function, we obtain the power spectral 
characteristics of the wind spike, (l/p) |c(w) | 2 , where c(w) is the 
Fourier transform of the wind spike. This function was then modified to 
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make the amplitudes of this pseudo- continuous spectra compatible with 
the discrete spectra for comparison purposes. The ordinate in the 
figure is given in power dB (i.e., 10 log 10 c P x 2 ( l %) where ^(^m) is the 
amplitude of the input sine wave at frequency (%) • 


Pilot describing function data were recorded as well as pilot 
opinion ratings and the integral of the error signal squared. 


The pilot describing function Y p was determined from standard 
relations for power density spectra in linear systems. These methods 
are dealt with more thoroughly in ( 11,16-18) . The actual data were 
analyzed on an analog power spectral analyzer. The pilot describing 
functions so measured are compared with that predicted in terms of their 
frequency response in Fig. 7* The predicted pilot describing function 
is also combined with the Ames tested controlled element Y c and com- 
pared with the experimentally measured Y p Y c in Fig. 8. These two 
figures indicate that the predicted Y p Is a fairly accurate descrip- 
tion of the pilot describing function in at least the low frequency 
range. The equalization characteristics are in very close agreement. 
There does, however, appear to be a slight difference in the phase. A 
low frequency phase droop is predictable from previous human response 
data but this was intentionally omitted from the predicted Y p in the 
analytic study because of its negligible effect on the system analysis. 
Unfortunately, the high frequency characteristics of the predicted 
describing function are not as easily verified for this control task. 

If the predicted high-frequency neuromuscular characteristics are 
assumed, the experimentally obtained Y p can best be described by 


o.47(i. 7ja + 1)e -I°-=5J“+(°-i/Jw-°.s)] 

[(ju/io) 2 + 2(l)(jw/l0) + 1] 


Thus far, only the pilot describing function portion of the "quasi- 
linear mathematical model" has been considered. However, the model is 
not complete without the remnant component. Before a completely valid 
comparison can be made of an actual pilot's performance with that of a 
quasi-linear mathematical model, the remnant term must be specified as 
well as the pilot describing function. Unfortunately, the remnant 
component has not been investigated so well as the pilot describing 
function and it was only briefly considered during the early analytical 
studies discussed in this report. Likewise, at this time, the remnant 
portion from the flight simulator experimental data has not been 
analyzed. However, even without a direct description of the remnant, 
several different sets of data were obtained during this study that 
indirectly show the strong influence of the remnant in this particular 
pilot booster control problem. 

A rough idea of the importance of the remnant term can be obtained 
from Figs. 9 and 10. Previously, it was noted that these pilot describ- 
ing functions were measured while the pilot was performing a random 
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appearing attitude tracking task in the pitch plane . During the tests , 
the ratio of the mean error signal squared to the mean input signal 
squared for the system when controlled by the pilot describing function 
and when controlled by two research pilots was measured and is presented 
in Fig. 9 • In addition. Fig. 10 shows the time history of the transverse 
accelerations that occur at the vehicle nose position while the vehicle 
is controlled by an actual pilot or by the predicted pilot describing 
function. These transverse accelerations are due to the first bending 
mode . Both figures indicate that something besides the given pilot 
describing function is necessary to describe the actual pilot perfor- 
mance adequately. It is suspected that these discrepancies are the 
result of not including the pilot remnant in the pilot model. 

During this evaluation of the pilot describing function, the 
analytic pilot describing function model was switched on and assumed 
control of the simulated vehicle without the actual pilot’s knowledge. 

It was reasoned that if the pilot failed to realize the switch, the 
mathematical model used was adequate to a first approximation. The time 
traces of this experiment are shown in Fig. 11. Even though Figs. 9 and 
10 show that the pilot’s output is not completely described by a describ- 
ing function, the actual pilot continued to control the vehicle for 
intervals of time exceeding a minute before he realized that he was no 
longer in control of the vehicle. It is also interesting that about a 
minute after the switch, the pilot’s control characteristics changed 
considerably (Fig. ll) . The most obvious change is the seemingly higher 
gain technique used. 

This brief evaluation of the "derived'’ and "measured" pilot describ- 
ing function data indicates that the available pilot describing function 
data are partially valid in the low frequency regions, up to unity gain 
crossover of YpY c , fcr the relatively unexplored problem discussed 
herein. However, preliminary results indicate that for the control prob- 
lem considered in this paper, the remnant term is of great importance and 
must be included in the analysis before a complete system analysis can be 
made. The effect of pilot remnant will be discussed later. 


5-3 Control Loop Structure 

The next step is to show some examples of the specific pilot- 
vehicle control systems that resulted from the experimental and analytical 
studies. The control systems presented are for the pitch plane of motion 
and for the series pilot plus augmented vehicle. At this point, it may 
appear inconsistent that the pilot describing function data were pre- 
sented for the unaugmented vehicle , whereas the control system data are 
presented for the series pilot plus augmented vehicle . However, these 
various sets of data were selected for discussion because they best 
illustrate the capabilities of the various techniques involved. The 
derivation of a pilot describing function is most challenging for a mar- 
ginally stable controlled element (unaugmented vehicle) . On the other 
hand, the real worth of the analytical techniques is demonstrated by 
their ability to define and predict the performance of an augmented- 
vehicle control system that has good performance and handling qualities, 
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etc . The specific pilot-vehicle control systems that resulted from the 
experimental and analytical studies are shown in block diagram form in 
Fig. 12. 


The flight- simulator derived system, in the upper part of the 
figure, is composed of an inner feedback loop which augments the vehicle 
stability. By means of an outer loop, certain vehicle state variables 
are displayed to the pilot and provide him with the necessary information 
to perform assigned tasks (such as, to reduce the structural loads, to 
stabilize and control vehicle attitude, etc.). There are two filters in 
the loops. The filter in the rate augmentation loop stabilizes the body 
bending or elastic modes of motion. The design procedure was typical of 
that used by an automatic flight -control system engineer, i.e . , finding 
a filter that would attenuate and/or shift the phase of the body-bending 
content of the feedback signal so that the stability margins would be 
adequate without significantly altering the rigid-body content of the 
signal. A second-order passive filter, immediately downstream from the 
pilot, smooths the output of the pilot’s controller at the elastic bending 
frequencies. This filter, in conjunction with the rate augmentation 
filter, stabilizes and reduces the magnitude of the elastic -structural 
excitation to an acceptable level. 

Now let us examine the pilot control system loops which resulted 
from the analytic approach. The equalization filter, selected to ade- 
quately augment the rigid mode stability and attenuate the bending modes, 
was placed in the forward path, as shown. The block diagram in Fig. 12 
is determined by the analytical procedures with no remnant effect applied. 

To understand the outside feedback loop, one must appreciate the 
pilot task involved. At lift-off, the pilot's task is to stabilize and 
control the vehicle attitude. As the region of maximum dynamic pressure 
is approached and as the wind disturbance is encountered, the pilot's 
primary task becomes one of reducing the structural load (termed load 
relief) on the vehicle by minimizing the body -bending moments, with sec- 
ondary emphasis on attitude control. When the attitude -stabilization 
task was analyzed, the outer loop was closed by transmitting the vehicle 
pitch angle cp to the loop element representing the pilot (Kp(t ) ) . 
Similarly, when the load-relief task was analyzed, the vehicle trans- 
verse acceleration A z formed the outside loop closure, since the pilot 
uses the transverse acceleration to help reduce the structural loads. A 
switch has been placed in the outside loop to indicate that the analytic 
method, admits to a single "error" quantity (i.e., attitude or accelera- 
tion) being fed into the pilot describing function box. The K/S terms 
shown will be discussed later . 

Some appreciation for the similarities between these two systems 
can be gained from a brief qualitative comparison of these loop struc- 
tures. The system block diagram in the lower portion of Fig. 12 has been 
recast into a completely equivalent block diagram and is shown in Fig . 13 . 

Fig. 13 shows that the analytical and experimental systems are simi- 
lar in that rate-feedback and rate-augmentation filters are present in 
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both systems. From a frequency-response standpoint , these two filters 
are nearly equivalent. One dissimilarity in the two systems is apparent 
in that the analytic investigation indicated that vehicle static stabil- 
ity is required for a good pilot rating. This was achieved by the inner- 
loop feedback of vehicle pitch attitude. However, this feedback does not 
represent a strong dissimilarity with the experimentally derived system, 
inasmuch as it only changes the vehicle's static stability from slightly 
negative to slightly positive. A major difference between these two con- 
trol systems is the pilot’s stick filter. An adequate description of 
the dynamics of the actual nonlinear time varying human pilot requires a 
describing function plus a remnant. Because of the lack of suitable rem- 
nant data, no quantitative design of the pilot’s stick filter using purely 
analytical techniques was attempted. However, it was predicted, qualita- 
tively, that a pilot’s stick filter might be required to reduce the vibra- 
tory excitation (6). The foregoing emphasis of differences in the 
pilot's stick filter may be confusing in view of the equalizing element 
that appears immediately downstream from the pilot. However, it should 
be recalled from the earlier discussion of this system, as shown in 
Fig. 12, that the lag elements were a direct result of stabilizing the 
bending modes and were not based on preventing the excitation of body 
bending caused by the pilot's controller output, per se . 

The foregoing discussion again points out one important aspect of 
the remnant or, really, the current dearth of suitable remnant data from 
which a good analysis can be made. Another aspect of this remnant prob- 
lem is associated with the placement of the K/S in the acceleration 
feedback loop (Figs. 12 and 13.). The K/S term was included mainly to 
improve the dynamic response of the vehicle at low frequencies. In a 
quasi-linear analysis that did not consider pilot remnant, it is not 
critical whether this term was placed in front of the pilot or down- 
stream from him; but, when the system performance was checked on a flight 
simulator with an actual (noisy) pilot in control, it was found to depend 
strongly upon the position of this term. Consequently, pilot remnant was 
concluded to be a dominant factor in system performance . It should be 
noted that pilot comments indicated the system performance was influenced 
to a certain extent by the pilot's difficulty in interpreting the dis- 
played control variables that had been filtered by the K/S term. Some 
performance figures showing the marked effect of pilot remnant (i.e . , 
position of the K/S term) on pilot-vehicle system performance will be 
discussed later . 

The analytic and experimental derived systems were compared briefly, 
on the basis of the control loop structure. Perhaps the best way to com- 
pare two piloted control systems is on the basis of 1 their performance . 
Accordingly, some quantitative as well as subjective performance measure- 
ments were made for the systems just discussed and these measures are 
shown in Fig. l4. These data are for the case in which the K/S term 
is placed downstream from the pilot. As noted previously, we will also 
present data for the case in which the K/S term is in front of the 
pilot. The performance measures are pilot rating, pilot opinion, M/m p, 
and The ratio M/Mp is the maximum vehicle structural bending 
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moment encountered as the vehicle penetrates the wind- shear region 
divided by the design bending moment. An M/Mp value of 1 or greater 
indicates structural failure. Any M/Mp value less than 1 is safe from 
a structural- load standpoint. It should be noted that the motions expe- 
rienced by the pilot of a flexible launch vehicle are somewhat similar 
to those that would be experienced by a pilot situated on the end of a 
long., flexing pole. The resulting oscillatory transverse accelerations, 
Np, are measures of the body bending. It was anticipated that large 
values of Ng may be undesirable since they may be detrimental to pilot 
control. It should be emphasized at this point that these performance 
measures were obtained by programming each system on the fixed-coclspit 
flight simulator . 

Figure l4 indicates that the performance of the two systems is 
almost identical with the exception of some minor differences in pilot 
comments on the handling qualities. Since certain factors (i.e., pilot 
stick filter design and perhaps other pilot remnant effects) were not 
considered in the derivation of the analytic system, it is somewhat sur- 
prising that the two systems are so similar in their performance capa- 
bility. However, after a moment's reflection, it becomes clear that the 
main benefit derived from the placement of the K/S term after the 
pilot is, essentially, that it acted as a pilot’s stick filter; conse- 
quently, the performance of the analytical and experimental derived 
systems were nearly the same. From a slightly different point of view, 
it appears that the K/S term modified the dynamics of the system so 
that the remnant portion of the pilot model was no longer an important 
element in the system analysis. 


5.4 Effects of Remnant Term on System Performance 

It was indicated earlier that the performance of the analytical 
derived system in a flight simulator was markedly influenced by shifting 
the K/S term from forward of the pilot to behind him. The performance 
data obtained were both objective and subjective; they point out the 
strong influence of the pilot remnant term in this particular pilot- 
vehicle control system. The results of this phase of the program are 
shown on Fig. 15. The data for the K/s filter after the pilot are 
presented in the lower part of the figure. Pilot ratings, pilot com- 
ments, and certain measures of pilot-vehicle system performance are 
given. Pilot ratings from 3 to 3“l/2 indicate a satisfactory system. 
Pilots' comments were "acceptable with mildly unpleasant characteristics" 
and "requires smooth control to prevent excitation of the body-bending 
motions." Values of M/Mp from 0.45 to 0.5 were measured with the pilot 
attempting to fly the vehicle so as to minimize the structural loading as 
the wind shear was penetrated. Values of the transverse accelerations at 
the pilot's position were from 0.05 to 0.1 g. 

Shifting the K/S term ahead of the pilot caused a marked deteriora- 
tion in the system performance and acceptability. The pilot rating 
deteriorated from satisfactory to unsatisfactory with handling qualities 
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accep table for emergency conditions only (rating of 6-1/2) . Pilot 
comments were 'Very difficult to interpret correct control action from 
the displays, etc." The values of M/Mp were doubled as a result of 
shifting the K/S term, the transverse accelerations experienced at the 
spacecraft cockpit were four times the previous level. 


5.5 Predicted and Measured Performance 

A pertinent question at this point is "How well can objective 
measures of system performance, such as pilot's opinion and pilot's 
numerical ratings of the vehicle control system handling qualities be 
predicted by closed-loop system analysis techniques?" Reference (6) 
states that making these predictions with the analytic method is "a 
difficult and highly artistic enterprise." Figure 16 shows the pilot 
comments and pilot ratings of vehicle handling qualities predicted from 
the analytic investigation as well as those gathered, for the same sys- 
tems, from flight simulator runs. In this case, data are given for two 
different systems, namely, the fully manual system (or unaugmented 
vehicle case) and the series pilot plus augmented vehicle control system. 
The pilot opinions and ratings measured from the flight simulator are 
shown along the lower portion of the figure and the predicted values are 
shown along the upper part. For the unaugmented vehicle the predicted 
and measured ratings agree substantially. The best numerical ratings by 
the participating pilots was 5> which is identical to the predicted 
value. The upper level of the predicted ratings was 9 > which was sub- 
stantially worse than the ratings which would be confirmed by flight 
simulator runs (i.e., 7 ) « Perhaps the most noteworthy point from these 
data is the close agreement between the pilot's predicted and actual 
comments . The major difference in pilot comments was the prediction 
that with appropriate displays, the pilot could fly the unaugmented 
vehicle about two axes. The pilot's actual comments indicated that it 
was possible to control the unaugmented vehicle about one axis only. In 
subsequent questioning, the pilots indicated that, in their opinion, this 
latter statement was true regardless of the displays. It was also pre- 
dicted that the accuracy in tracking pitch guidance commands would be 
poor. This prediction stemmed from the droop of the frequency-response 
curve in the lower frequency range of the spectra for the controlled 
element in the analytic investigation (Fig. 5) • As noted previously, 
the controlled element, as investigated on the flight simulator, did not 
exhibit this characteristic and hence this latter predicted pilot comment 
was never verified. 

Now consider the augmented vehicle . Only one set of flight simula- 
tor data is shown, i.e., for the K/S term behind the pilot. These data 
are presented, since the previous discussions indicate this is the par- 
ticular case for which the "analytic techniques" might predict pilot 
ratings and pilot opinions. 

For the augmented vehicle, the flight simulator derived ratings 
ranged from 3 to 3 _ l/2. It was predicted that the ratings would range 
from 3 to 6, which is a rather imprecise prediction of pilot rating 
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although it does bracket the measured pilot-rating data. Pilots 
comments are in fair agreement, but the predicted comments lead one to 
believe that excitation of body-bending motion is no problem. Actual 
pilot comments, however, indicate that smooth control inputs are neces- 
sary to prevent such excitation. 


6 . DISCUSSION OF A TECHNIQUE FOR RELIABILITY ANALYSIS 


The conclusion reached from the studies discussed in the first part 
of this paper was that piloted control of a large flexible launch vehicle 
is feasible. Thus it would be expected that the "probability of mission 
success" would be increased if a manual control system were added to 
back up the vehicle’s automatic flight control system. An analysis was 
made to determine whether the probability of mission success could be 
increased by incorporating the proposed piloted backup control system. 

The technique for measuring the reliability contribution of a piloted 
backup system is the subject of this section of the paper. 

The technique is similar to one that has been used for the automatic 
system. It is also similar to the "Pilot-Controller Integration for 
Emergency Conditions" concept ( 19 ) which was refined and applied to the 
X- 22A V/STOL vehicle (20) . 

The seven steps inherent in the technique are shown in Fig. 17 and 
are discussed below. 

1. Define system: Collect the necessary information on the vehicle, 

systems, trajectory, mission, etc., to enable a simulation to be con- 
ducted. Define manual system. 

2. Define major failure modes: Predict major failure modes (as 

opposed to component failure modes). Define failure dynamics and obtain 
necessary information to simulate failure modes. Obtain unreliability 
number (probability of occurrence) for each major failure mode. 

3 . Simulate system and failure modes: Use the data gathered in 

steps 1 and 2 and appropriate mathematical models to develop a real-time 
piloted flight simulation of the vehicle and its major failure modes. 

4. Define pilot procedures: Use the flight simulation developed 

in step 3, conduct a systematic investigation wherein the failure modes 
investigated are made to occur at various times of flight with the 
pilot in control of the simulated vehicle. From this investigation, 
develop background information from which the crew can learn to detect 
and correctly identify each failure as well as to follow the correct 
pilot procedure in the event of a failure. (Most of the emergency sec- 
tion of the pilot's handbook is written during this study phase. Also, 
at this time , preliminary changes to the proposed manual system can be 
made . ) 
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5* Conduct simulation with random failures: Using several subjects 

and a large number of simulated flights with random failures , determine 
the probability of mission failure (effectivity) for each of the major 
failure modes. 

6. Determine probability of mission failure: Using the unreli- 

ability numbers from step 2 and the effectivity numbers from step 5> 
calculate the failure mode criticality (effect of failure on probability 
of mission failure) . 

7. Modify system and procedures as necessary: Analyze the results 

of step 6 to determine those failure modes having the greatest influence 
on mission failure. Redesign the system or modify the procedures devel- 
oped in step 4 as necessary to reach a suitable level of "probability 

of mission success.” 

The application of these seven steps to the subject vehicle will now be 
discussed. 


6.1 Definition of Launch Vehicle and Systems 

The example boost vehicle carries the second stage, third stage, 
and the spacecraft from the launch pad through the high dynamic -pres sure 
region to staging at an altitude of about 66,000 m. The flight lasts 
about 2-l/2 minutes and stages at about 2,^00 m/s ee. The control prob- 
lem is complicated by wind and gusts, as well as by flexible-body and 
fuel-sloshing dynamics with frequencies approaching control frequencies. 

The control system selected for this portion of the study is based 
on earlier feasibility studies (Fig. l8) . The upper half of the figure 
shows (solid lines) the automatic system as implemented in this study. 
The engine actuator command signals are attitude rate and attitude error 
summed, gained, and filtered in the control computer. The vehicle has 
five thrust engines, four of which are control engines. This provides 
some redundancy in the event of thrust losses or actuator failures. The 
lower half shows (solid lines) the spacecraft control system. The 
dashed lines indicate the items added for the proposed manual backup 
system. The pilot’s display included attitude error, from the launch- 
vehicle guidance system, as well as the outputs from body-mounted accel- 
erometers in the launch vehicle. The display included altitude, veloc- 
ity, flight-path angle, etc., of the spacecraft. The output of the pilot 
controller was passively filtered (low pass to attenuate output at 
flexible body frequencies) and summed with the output of the automatic 
system at the control computer. This system allowed the pilot to form 
an adaptive-parallel control loop which is activated when failures occur 
in the primary system. 


6.2 Definition of Major Failure Modes 

The launch-vehicle major failure modes can be divided into three 
categories: (l) control-system hardware failures (gyros, wiring, etc.). 
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(2) engine actuator failures (hard over, null, oscillating), and ( 3 ) 
thrust failures. The first ten failures in Fig. 2 are the launch 
vehicle major failure modes considered in order of their assumed unre- 
liabilities (probability of occurrence) . The unreliability for each 
failure mode is shown relative to the most probable failure mode (one 
engine actuator hard over). Failure modes 11 through 19 of Fig. 19 are 
associated with the hardware added as a result of the piloted backup 
system. The unreliability data for the pilot’s displays are not shown 
since no mission failures were caused by a display failure. 


6.3 Simulation System and Failure Modes 

A detailed and comprehensive fixed-cab simulation was set up . It 
included fuel sloshing, engine, and flexible-body dynamics as well as 
six-degree-of -freedom rigid-body dynamics. 


6.4 Definition of Pilot Procedures 

The pilot's primary task before a system failed was to monitor the 
displays. His only control inputs were those necessary for load relief 
in the event of large wind- induced aerodynamic loads. He reduced the 
loads by closing the piloted parallel loop using the displayed output 
signals of the body-mounted accelerometers. Reducing these aerodynamic 
loads gives the vehicle a greater margin of safety in the event of a 
system failure . 

In the event of a launch- vehicle system failure (i.e., failures 1 
through 10), the "overriding" pilot’s procedure was to "keep the attitude 
of the vehicle at the nominal value." He did this by operating as an 
adaptive element in the loop that paralleled the automatic flight -control 
system. For hardware failures in the launch-vehicle control system 
(i.e., loss of platform, attitude rate, attitude signal, etc.), the pilot 
used information displayed from sensors located in the spacecraft to 
stabilize and control the vehicle attitude. Specifically, if the launch 
vehicle attitude-rate loop malfunctions (i.e., failure 6 or 10) and the 
vehicle motions become unstable, the pilot, using the displayed-rate 
information (which is sensed from gyros located in the spacecraft) , takes 
over and stabilizes the vehicle motions. When an engine actuator fails, 
the vehicle develops asymmetric rotational moments. In this case, the 
pilot acts as an integration type element in that he injects trimming or 
bias commands to null the unbalanced or asymmetric rotational moments. 

In the case of a single display failure, the information displayed was 
sufficiently redundant that by a quick cross-check the pilot was able to 
detect which instrument had failed and continue to fly the vehicle using 
the remaining sources of displayed information. 


6.5 Simulation With Random Failures 

It should be pointed out that in this study we were concerned 
principally with the question "is the automatic flight-control system 
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plus a piloted backup system more or less reliable than the automatic 
flight-control system taken alone?" The reliability level of the auto- 
matic flight-control system forms the reference condition, thus making 
it necessary to measure the reliability of the automatic system using 
the same flight simulation setup , same flight conditions , etc that were 
used for the piloted system. 

There were several variables to consider in the simulation: the 

number of pilots (3 used) and failures (19 for piloted system and 10 for 
the automatic), the wind magnitude (2 used), the time of failure (3 
major divisions; before, at, and after high q) , and the wind direction 
(i.e., for some failures the vehicle turns into or away from wind). 

From these variables it was determined that there were 176 basic failure 
situations per pilot for the piloted system and ll6 for the automatic. 

To make the number of failures approximately proportional to probability 
of occurrence , 79 additional situations were added making a total of 255 
situations per pilot for the manual system and 195 for the automatic 
system. These situations were then presented to the pilot in a random 
order with one failure for each simulated flight . The automatic system 
data were obtained at the same time the simulation was set up for the 
manual flights. The probability of mission failure for a major failure 
mode (effectivity number) was calculated from these data. The criteria 
for a successful or unsuccessful flight were vehicle structural loading 
and guidance considerations . 


6.6 Determination of the Probability of Mission Failure 

The major failure mode effectivity numbers as determined by the 
simulation are tabulated in Fig. 20. The data are shown for one wind 
magnitude only. The failure mode criticality (probability of mission 
failure) shown in Fig. 20 is the product of the failure mode unreli- 
ability and effectivity numbers. Since the unreliability numbers were 
normalized to the most probable failure mode, the criticality numbers 
also have only relative significance. The overall mission criticality, 
shown at the bottom of Fig. 20, is obtained by summing the criticality 
numbers for the appropriate failure modes. The results indicate that 
including the pilot in a backup control system for the first stage 
reduces mission criticality by a factor of 2. 


7. DISCUSSION 


Some results obtained in the present study are applicable to certain 
other vehicles. Consider the question of what is the optimum pilot con- 
trol mode for the all-weather landing of large transport aircraft. The 
trend has favored a fully automatic system with pilot monitor and backup . 
This is precisely the mode of control used for the present study. A sig- 
nificant question concerning this mode of control is "Can the pilot 
adapt to the failure dynamics jfast enough in the event of a failure?" 
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The present study shows that, with sufficient recent practice , the 
pilot could adapt to the failure dynamics from a monitor mode as fast as 
from a primary control mode . 

The pilot's ability to recognize display failures was another sig- 
nificant result of the study. As seen in Fig. 20, no mission failures 
were attributable to display failures (zero effectivity) . Inadvertent 
takeovers were eliminated by the ground rule that two separate indica- 
tions of a failure were necessary before a pilot could take over. 

A third significant result of the study was the pilot's ability to 
act as a highly effective frequency selective filter . In the backup 
mode of operation considered, the pilot was required to act as an adap- 
tive parallel loop to the automatic system. Depending on the failure 
mode, he was required to close attitude, attitude rate, and/or acceler- 
ometer load-relief loops. By observing his display panel, the pilot 
quite easily separated out and disregarded the flexible body content of 
these sensor signals ; in most instances, this allowed the pilot to con- 
trol rigid-body motions more effectively than an automatic system 
utilizing passive filtering of the flexible-body signals. 


8. CONCLUDING REMARKS 


The technique described above allows mission success to be sys- 
tematically determined for a complex manual system. The technique 
further indicates those systems or procedures requiring further develop- 
ment. In addition, several specific results applicable to other large 
vehicles resulted from the study. 
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Fig. 3 Technical constraints. 



Fig. if-.- Pilot -vehicle control systems. 
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Fig. 5 •- Controlled element -full manual . 
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Fig. T-- Comparison of measured and predicted pilot describing functions. 



Fig. 8.- Combined pilot-vehicle open-loop frequency response. 
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Fig. 9*“ Conparison of pilot and pilot describing function performance. 
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Fig. 10.- Body bending with vehicle controlled by pilot and by pilot 

describing function. 
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CHARACTERISTICS 

REQUIRES SMOOTH CONTROL 
INPUTS TO PREVENT EXCITATION 
OF BODY BENDING MOTIONS 

.45 

TO .55 

.05 
TO .1 


Fig. l4 Performance comparison. 
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^\1NDICES 

PILOTED\^ 
SYSTEM \ 

PILOT 

RATING 

PILOT COMMENTS 

. 

M/Mq 

n,g 

K/S 

BEFORE PILOT 

' 

' 

5 TO 

6 i 

VERY DIFFICULT TO INTERPRET 
CORRECT CONTROL ACTION FROM 
DISPLAYS 

LITTLE FEEDBACK OF ELASTIC 
MOTIONS TO PILOT THROUGH 
ACCELERATION DISPLAY YET 
SMOOTH CONTROL INPUTS ARE 
NECESSARY TO PREVENT LARGE 
EXCITATION OF ELASTIC MOTIONS 

.85 
TO 1.15 

.11 

TO .49 

K/S 

AFTER PILOT 

3 TO 
3 { 

ACCEPTABLE, MILDLY UNPLEASANT 
CHARACTERISTICS 
REQUIRES SMOOTH CONTROL 
INPUTS TO PREVENT EXCITATION 
OF BODY BENDING MOTIONS 

.45 

TO .55 

.05 
TO .1 


Fig . 15 • - Influence of pilot remnant • 


FULL MANUAL SERIES PILOT + AUGMENTED VEHICLE 


Indices 

PILOT 

RATING 

PILOT COMMENT 

PILOT 

RATING 

PILOT COMMENT 

PREDICTED 

5 TO 9 
(ONE 
AXIS) 

EXTREMELY DIFFICULT TO CONTROL 
IN THE PRESENCE OF ANY 
DISTURBANCES 

PILOT WILL BE NEAR LIMITS 
OF CONTROL 

HANDLING QUALITIES POOR 
PILOT CAN FLY TWO AXES WITH 
PROPER DISPLAYS 
ACCURACY IN TRACKING PITCH 
GUIDANCE COMMANDS IS POOR 

3 TO 6 

HANDLING QUALITIES SHOULD 
BE APPRECIABLY BETTER 
THAN FOR FULL MANUAL 
SYSTEM 

GOOD TRACKING ACCURACY 
AND MINIMIZATION OF 
INTERNAL SYSTEM 
DISTURBANCES 

MEASURED i 
FROM ! 
SIMULATOR 


VERY DIFFICULT TO FLY 
REQUIRES CONSTANT ATTENTION 
TO PREVENT LOSS OF CONTROL j 
POSSIBLE TO CONTROL ABOUT 
1 - AXIS ONLY 

3 TO 

ACCEPTABLE, MILDLY 
UNPLEASANT CHARACTER- 
ISTICS 

REQUIRES SMOOTH CONTROL 
INPUTS TO PREVENT 
EXCITATION OF BODY 
BENDING MOTIONS 


. l6.- Comparison of predicted and measured performance. 
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Fig. !?•" Technique for measuring probability of mission success. 
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Fig. l8.- Launch vehicle backup guidance and control system- 
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NO. 


FAILURE 


UNRELIABILITY 


1 

2 

3 

4 

5 

a 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 
19 


ONE ACTUATOR HARD OVER 
LOSS OF THRUST (ONE) 

TWO ACTUATORS INOPERATIVE 
LOSS OF PLATFORM 
ONE ACTUATOR OSCILLATORY 
LOSS OF ATTITUDE RATE 
ONE ACTUATOR INOPERATIVE 
LOSS OF ATTITUDE SIGNAL 
ATTITUDE SIGNAL SATURATE 
ATTITUDE RATE SATURATE 
ATTITUDE DISPLAY (LOCK, JUMP, DRIFT) 
ATTITUDE ERROR DISPLAY NULL 
ATTITUDE ERROR DISPLAY SATURATE 
ATTITUDE RATE DISPLAY NULL 
ATTITUDE RATE DISPLAY SATURATE 
ACCELEROMETER DISPLAY NULL 
ACCELEROMETER DISPLAY SATURATE 
HAND CONTROLLER NULL 
HAND CONTROLLER SATURATE 


mum 


m 


3 

3 





Fig. 19*- Failures considered. 


NO. 


EFFEC- 

UNREL1 ABILITY SYSTEM TIVITY CRITICALITY 


1 

ONE ACTUATOR HARD OVER 


MAN 

AU 

UAL 

TO 

.045 

.488 


2 

LOSS OF THRUST (ONE) 




.439 

.450 


3 

TWO ACTUATORS INOPERATIVE 




.011 

.392 

\mmmm 

4 

LOSS OF PLATFORM 

ziD 



.044 

.666 


5 

ONE ACTUATOR OSCILLATORY 

Em 



,577 

.400 

//'///A 

6 

LOSS OF ATTITUDE RATE 

3 



.090 

.801 


7 

ONE ACTUATOR INOPERATIVE 

3 



0 

.401 


8 

LOSS OF ATTITUDE SIGNAL 




0 

.578 


9 

ATTITUDE SIGNAL SATURATE 




.444 

.667 


10 

ATTITUDE RATE SATURATE 




LOOO 


1 1 

ATTITUDE DISPLAY (LOCK, JUMP, DRIFT) 




0 

N.A. 


12 

ATTITUDE ERROR DISPLAY NULL 




N?A. 


13 

ATTITUDE ERROR DISPLAY SATURATE 




0 

N.A. 


14 

ATTITUDE RATE DISPLAY NULL 




0 

N.A. 


15 

ATTITUDE RATE DISPLAY SATURATE 




0 

N.A. 


1 6 

ACCELEROMETER DISPLAY NULL 




0 

N.A. 


17 

ACCELEROMETER DISPLAY SATURATE 




0 

N.A. 


18 

HAND CONTROLLER NULL 




0 

N.A. 


19 i 

HAND CONTROLLER SATURATE 


MAN 

AU 

UAL 

Tp 

.440 

N.A. 



TOTAL MAN. g 

CRITICALITY AUTO. 1 




Fig. 20.- 


Criticality study , 


maximum wind 


condition. 
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